nixos/modules/hosts/robin/configuration.nix

{ self, inputs, ... }: {
  flake.nixosModules.robinConfiguration = { pkgs, config, ... }: {
    imports = [
      self.nixosModules.robinHardware
      self.nixosModules.nest

      self.nixosModules.git
      self.nixosModules.zsh
    ];

    environment.systemPackages = with pkgs; [
      kubectl
      htop
      zip
      unzip
      dig
      traceroute
      neovim
      wget
      openiscsi # Required for longhorn
      nfs-utils
    ];

    networking.networkmanager.enable = true;
    networking.hostName = "robin";

    services = {
      openssh.enable = true;

      openiscsi.enable = true;
      openiscsi.name = "iqn.2005-10.nixos:${config.networking.hostName}";

      envfs.enable = true;
    };

    # Enable K3s in Agent Mode
    services.k3s = {
      enable = true;
      role = "agent";
      
      serverAddr = "https://192.168.1.122:6443"; 
      tokenFile = "/var/lib/rancher/k3s/join-token";
    };

    # Fix non-FHS paths for longhorn
    # This creates persistent symlinks where Longhorn expects to find them.
    systemd.tmpfiles.rules = [
      "L+ /usr/bin/iscsiadm - - - - /run/current-system/sw/bin/iscsiadm"
      "L+ /sbin/iscsiadm    - - - - /run/current-system/sw/bin/iscsiadm"
      "L+ /bin/mount - - - - /run/current-system/sw/bin/mount"
      "L+ /bin/umount - - - - /run/current-system/sw/bin/umount"
      "L+ /bin/nsenter - - - - /run/current-system/sw/bin/nsenter"
    ];

    # RAID
    boot.swraid = {
      enable = true;
      mdadmConf = ''
        MAILADDR root
        ARRAY /dev/md0 level=raid10 num-devices=4 metadata=1.2 UUID=f94b90a5:574f242f:00596ed9:a2b369c7
      '';
    };

    fileSystems."/mnt/raid" = {
      device = "/dev/disk/by-uuid/208bee23-4723-42c2-ac4e-c902eb530f80";
      fsType = "ext4";
      options = [ "defaults" "nofail" ];
    };

    # NFS
    services.nfs = {
      server.enable = true;
      server.exports = ''
        /export/yarr 192.168.1.0/16(rw,secure,anonuid=1000,anongid=1000,all_squash)
        /export 192.168.1.0/16(ro,fsid=0,root_squash,subtree_check,secure)
      '';

      # Pin the ports
      server.statdPort = 4000;
      server.lockdPort = 4001;
      server.mountdPort = 4002;
    };

    fileSystems."/export/yarr" = {
      device = "/mnt/raid/yarr";
      fsType = "ext4";
      options = [ "bind" ];
    };

    networking.firewall = {
      enable = true;
      
      allowedTCPPorts = [ 
	22 # SSH (CRITICAL: Do not remove)

        # --- NFS Ports ---
        111 2049 4000 4001 4002 
        
        # --- K3s Agent Ports ---
        10250  # Kubelet API (Required for master node logs/metrics/exec)
        9100  # Prometheus Node Exporter
      ];
      
      allowedUDPPorts = [ 
        # --- NFS Ports ---
        111 2049 4000 4001 4002 
        
        # --- K3s Agent Ports ---
        8472   # Flannel VXLAN overlay networking (Required for pod-to-pod communication)
      ];
    };

    boot = {
      loader = {
        systemd-boot.enable = true;
	efi.canTouchEfiVariables = true;
	timeout = 1;
      };

      kernelPackages = pkgs.linuxPackages_latest;
      supportedFilesystems = [ "nfs" ];
    };

    time.timeZone = "America/New_York";
    time.hardwareClockInLocalTime = false;

    nix.settings.experimental-features = [ "nix-command" "flakes" ];
    nix.settings.auto-optimise-store = true;
    nix.gc = {
      automatic = true;
      dates = "weekly";
      options = "--delete-older-than 30d";
    };

    nixpkgs.config.allowUnfree = true;

    system.stateVersion = "26.05";
  };
}